In countries such as the United States, the postal authority does not permit a customer to actually own a postage meter. Rather, the postal customer rents the postage meter from a manufacturer approved by the postal authority, such as the assignee of the present application. This meter is then used at the postal customer's facility.
In the United States, the postal customer traditionally adds postage to the meter in two ways. The first is to physically take the meter to the postal authority where postage is purchased and added to the meter. The second is to remotely add postage over the telephone line with a modem wherein the added postage is deducted from an account maintained with the meter's manufacturer.
While postal equipment in general, and postage meters in particular, are designed to be extremely reliable, on occasion a customer's meter has been known to fail. Generally speaking, there are two types of failures, catastrophic and non-catastrophic. The non-catastrophic is by far the most common of the two, and occurs when some component of the postage meter ceases to operate, such as the display, a mechanical linkage, etc. A catastrophic failure occurs when some or all of the information stored in nonvolatile memory is not recoverable, as discussed below.
The consequence of a non-catastrophic meter failure is primarily one of customer inconvenience. When such a failure occurs, the customer no longer has use of the equipment and must call for technical support. A field repair or replacement must then be scheduled, which further lengthens the "down time" of the equipment for the customer. In the case of a metering device, the failed device needs to be removed from service, the postal authority notified, and a replacement unit logged with the postal authority, and then finally provided to the customer. Depending on what component failed, certain information contained in the failed meter may be transferred to the replacement meter by the service technician.
In an electronic postage meter the amount of postage available for printing (or printed) is stored in a nonvolatile memory. It may be desirable to store the accounting data redundantly, as set forth in PCT pub. no. WO 89-11134, which is incorporated herein by reference. In addition, it may be desirable that the redundant memories be of differing technologies, as set forth in the aforementioned PCT publication. Finally, it is extremely desirable to protect the memory from harm due to processor malfunction, as set forth in U.S. Pat. No. 5,276,844, in EP pub. no. 527010, or in EP pub. no. 737944, each of which is incorporated herein by reference.
The user of an electronic postage meter should not be able to affect the stored postage data in any way other than reducing it (by printing postage) or increasing it (by authorized resetting activities). Some single stored location must necessarily be relied upon by all parties (the customer, the postal authority, and the provider of the meter) as the sole determinant of the value of the amount of postage available for printing. In electronic postage meters, the single stored location is the secure physical housing of the meter itself. Within the secure housing, one or more items of data in one or more nonvolatile memories serve to determine the amount of postage available for printing.
While a catastrophic failure is rare, the consequences of a catastrophic failure are far more severe, namely loss by the user of postage value for which the postal authority has already been paid. Furthermore, it is possible that in a catastrophic failure no information contained in the failed meter may be transferred to the replacement meter by the service technician. Thus, there is also the loss of historical data which may be of value to the customer.